Cisco Support
English
Feedback Help
Cisco Support Community
Register
cancel
turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Member since ‎09-03-2008
‎07-18-2018
Cesar Adrian Garza Ruiz
Cesar Adrian Garza Ruiz
Community Member

Hi, I have the same issue, I

Created by Cesar Adrian Garza Ruiz in IP Telephony
‎05-19-2014 09:12 AM
‎05-19-2014 09:12 AM
Hi, I have the same issue, I just install a new clean CUCM 9.1 and CUC 9.1 in UCS C220 with pre-installed esxi 5.1, I leave the clients site the last Friday and today say to me that the servers is down, just turn on the server and everything comes back, in the vmware logs the only error that show is "2014-05-18T15:31:00.802Z [3DAE2B90 error 'SoapAdapter.HTTPService'] HTTP Transaction failed on stream TCP(error:Transport endpoint is not connected) with error N7Vmacore15SystemExceptionE(Connection reset by peer)" but I saw that error in the log before I installed this site the last May 5, anyone have a clue of what I have to look. Of if this error could do a crash or reset in the system.   Thanks in advance.   Cesar ... View more

Hi Everyone, I have the same

Created by Cesar Adrian Garza Ruiz in IP Telephony
‎05-07-2014 03:48 PM
‎05-07-2014 03:48 PM
Hi Everyone, I have the same issue, is a new clean installation with the upgrade of the dev. pack I can add all the phones but stills in register, with others phones is working fine 7965 phones and CIPC, any answer with thiss issue.   Best regards.   CG ... View more

Re: Vpn site-to-site phase2 fail

Created by Cesar Adrian Garza Ruiz in VPN
‎07-14-2010 08:32 AM
‎07-14-2010 08:32 AM
Hi Marcin, yes but theres something strange, because the configs are almost the same, the way that I have to force to work is, I erase all the configuration and re-enter, and automatically work, before I did this I force to activate the tunnel and I was working through the vpn, and the vpn client was working too, and the other VPN to Brasil too. But when I tested as if the DSL is down, the trouble comes again, because the Vpn seems to ask the XAUTH, I put the XAUTH line and work, but the vpn client didnt, I quit the xauth and the vpn client starts works. I mean the only way that the vpn set up automatically was if I erased all the config and put it again. But the VPN tunnel is working in the way that the traffic is passing through. Cesar ... View more

Re: Telnet SSH not working Strange

Created by Cesar Adrian Garza Ruiz in WAN, Routing and Switching
‎07-12-2010 08:15 AM
‎07-12-2010 08:15 AM
Oh Man !!! I sure I probe with the exec line... but you both right... thanks !!! ... View more

Telnet SSH not working Strange

Created by Cesar Adrian Garza Ruiz in WAN, Routing and Switching
‎07-09-2010 04:05 PM
‎07-09-2010 04:05 PM
Hi all,      I have a very strange issue here, after I read a lot of posting about the telnet problem no one resolving mine, actually I have everything configurated, well is not much, but I do not have any access list, no firewall between, only nat and I do not think this was the problem, the thing is that after telnet the IP I receive an Open, but almost instantly close the session, in the case of the SSH I receive the prompt for the password, but when I introduce the correct password the ssh session close. I do not receive any message, just that the foreing host closed. Remote Router: INTERNET_TMX#telnet 9.2.8.1 Trying 9.2.8.1 ... Open [Connection to 9.2.8.1 closed by foreign host] INTERNET_TMX#ss INTERNET_TMX#ssh -l cisco 9.2.8.1 Password: [Connection to 9.2.8.1 closed by foreign host] Config; ip nat inside source route-map nonat interface Dialer1 overload ! ip access-list extended lan2lan permit ip 192.168.225.0 0.0.0.255 192.168.0.0 0.0.255.255 permit ip 192.168.226.0 0.0.0.255 192.168.0.0 0.0.255.255 ip access-list extended nat deny   ip 192.168.225.0 0.0.0.255 192.168.0.0 0.0.255.255 deny   ip 192.168.226.0 0.0.0.255 192.168.0.0 0.0.255.255 permit ip 192.168.225.0 0.0.0.255 any permit ip 192.168.226.0 0.0.0.255 any ! route-map nonat permit 1 match ip address nat ! line con 0 logging synchronous login local no modem enable line aux 0 line 2 no activation-character no exec transport preferred none transport input all transport output pad telnet rlogin lapb-ta mop udptn v120 ssh line vty 0 4 login local no exec transport input telnet ssh ! end Debug: GW_MONMORELOS#debug telnet *Jul  9 22:53:13.974: Telnet67: 1 1 251 1 *Jul  9 22:53:13.974: TCP67: Telnet sent WILL ECHO (1) *Jul  9 22:53:13.974: Telnet67: 2 2 251 3 *Jul  9 22:53:13.974: TCP67: Telnet sent WILL SUPPRESS-GA (3) *Jul  9 22:53:13.974: Telnet67: 80000 80000 253 24 *Jul  9 22:53:13.974: TCP67: Telnet sent DO TTY-TYPE (24) *Jul  9 22:53:13.974: Telnet67: 10000000 10000000 253 31 *Jul  9 22:53:13.974: TCP67: Telnet sent DO WINDOW-SIZE (31) GW_MONMORELOS#debug ip ssh        Incoming SSH debugging is on GW_MONMORELOS# GW_MONMORELOS# GW_MONMORELOS# *Jul  9 22:55:02.254: SSH0: starting SSH control process *Jul  9 22:55:02.254: SSH0: sent protocol version id SSH-2.0-Cisco-1.25 *Jul  9 22:55:02.270: SSH0: protocol version id is - SSH-1.99-Cisco-1.25 *Jul  9 22:55:02.270: SSH2 0: send:packet of  length 344 (length also includes padlen of 5) *Jul  9 22:55:02.270: SSH2 0: SSH2_MSG_KEXINIT sent *Jul  9 22:55:02.274: SSH2 0: ssh_receive: 344 bytes received *Jul  9 22:55:02.274: SSH2 0: input: total packet length of 344 bytes *Jul  9 22:55:02.274: SSH2 0: partial packet length(block size)8 bytes,needed 336 bytes,                maclen 0 *Jul  9 22:55:02.274: SSH2 0: input: padlength 5 bytes *Jul  9 22:55:02.274: SSH2 0: SSH2_MSG_KEXINIT received *Jul  9 22:55:02.274: SSH2:kex: client->server enc:aes128-cbc mac:hmac-sha1 *Jul  9 22:55:02.274: SSH2:kex: server->client enc:aes128-cbc mac:hmac-sha1 *Jul  9 22:55:02.294: SSH2 0: ssh_receive: 24 bytes received *Jul  9 22:55:02.294: SSH2 0: input: total packet length of 24 b GW_MONMORELOS#ytes *Jul  9 22:55:02.294: SSH2 0: partial packet length(block size)8 bytes,needed 16 bytes,                maclen 0 *Jul  9 22:55:02.294: SSH2 0: input: padlength 6 bytes *Jul  9 22:55:02.294: SSH2 0: SSH2_MSG_KEX_DH_GEX_REQUEST received *Jul  9 22:55:02.294: SSH2 0: Range sent by client is - 1024 < 2048 < 4096 *Jul  9 22:55:02.294: SSH2 0:  Modulus size established : 2048 bits *Jul  9 22:55:02.294: SSH2 0: send:packet of  length 280 (length also includes padlen of 8) *Jul  9 22:55:02.350: SSH2 0: expecting SSH2_MSG_KEX_DH_GEX_INIT *Jul  9 22:55:02.486: SSH2 0: ssh_receive: 272 bytes received *Jul  9 22:55:02.486: SSH2 0: input: total packet length of 272 bytes *Jul  9 22:55:02.486: SSH2 0: partial packet length(block size)8 bytes,needed 264 bytes,                maclen 0 *Jul  9 22:55:02.486: SSH2 0: input: padlength 5 bytes *Jul  9 22:55:02.486: SSH2 0: SSH2_MSG_KEXDH_INIT received *Jul  9 22:55:02.598: SSH2 0: signature length 143 *Jul  9 22:55:02.598: SSH2 0: send:packet of  length 576 (length also includes padlen of 7) *Jul  9 22:55:02.602: SSH2: kex_derive_keys complete *Jul  9 22:55:02.602: SSH2 0: send:packet of  length 16 (length also includes padlen of 10) *Jul  9 22:55:02.602: SSH2 0: newkeys: mode 1 *Jul  9 22:55:02.602: SSH2 0: SSH2_MSG_NEWKEYS sent *Jul  9 22:55:02.602: SSH2 0: waiting for SSH2_MSG_NEWKEYS *Jul  9 22:55:02.858: SSH2 0: ssh_receive: 16 bytes received *Jul  9 22:55:02.858: SSH2 0: input: total packet length of 16 bytes *Jul  9 22:55:02.858: SSH2 0: partial packet length(block size)8 bytes,needed 8 bytes,                maclen 0 *Jul  9 22:55:02.858: SSH2 0: input: padlength 10 bytes *Jul  9 22:55:02.858: SSH2 0: newkeys: mode 0 *Jul  9 22:55:02.858: SSH2 0: SSH2_MSG_NEWKEYS received *Jul  9 22:55:02.858: SSH2 0: ssh_receive: 52 bytes received *Jul  9 22:55:02.858: SSH2 0: input: total packet length of 32 bytes *Jul  9 22:55:02.858: SSH2 0: partial packet length(block size)16 bytes,needed 16 bytes,                maclen 20 *Jul  9 22:55:02.858: SSH2 0: MAC compared for #4 :ok *Jul  9 22:55:02.858: SSH2 0: input: padlength 10 bytes *Jul  9 22:55:02.858: SSH2 0: send:packet of  length 32 (length also includes padlen of 10) *Jul  9 22:55:02.858: SSH2 0: computed MAC for sequence no.#4 *Jul  9 22:55:02.874: SSH2 0: ssh_receive: 84 bytes received *Jul  9 22:55:02.874: SSH2 0: input: total packet length of 64 bytes *Jul  9 22:55:02.874: SSH2 0: partial packet length(block size)16 bytes,needed 48 bytes,                maclen 20 *Jul  9 22:55:02.874: SSH2 0: MAC compared for #5 :ok *Jul  9 22:55:02.874: SSH2 0: input: padlength 19 bytes *Jul  9 22:55:02.874: SSH2 0: send:packet of  length 48 (length also includes padlen of 8) *Jul  9 22:55:02.874: SSH2 0: computed MAC for sequence no.#5 *Jul  9 22:55:02.890: SSH2 0: ssh_receive: 116 bytes received *Jul  9 22:55:02.890: SSH2 0: input: total packet length of 96 bytes *Jul  9 22:55:02.894: SSH2 0: partial packet length(block size)16 bytes,needed 80 bytes,                maclen 20 *Jul  9 22:55:02.894: SSH2 0: MAC compared for #6 :ok *Jul  9 22:55:02.894: SSH2 0: input: padlength 16 bytes *Jul  9 22:55:02.894: SSH2 0: send:packet of  length 48 (length also includes padlen of 11) *Jul  9 22:55:02.894: SSH2 0: computed MAC for sequence no.#6 *Jul  9 22:55:05.778: SSH2 0: ssh_receive: 52 bytes received *Jul  9 22:55:05.778: SSH2 0: input: total packet length of 32 bytes *Jul  9 22:55:05.778: SSH2 0: partial packet length(block size)16 bytes,needed 16 bytes,                maclen 20 *Jul  9 22:55:05.778: SSH2 0: MAC compared for #7 :ok *Jul  9 22:55:05.778: SSH2 0: input: padlength 7 bytes *Jul  9 22:55:05.782: SSH2 0: send:packet of  length 16 (length also includes padlen of 10) *Jul  9 22:55:05.782: SSH2 0: computed MAC for sequence no.#7 *Jul  9 22:55:05.786: SSH2 0: authentication successful for citrofrut *Jul  9 22:55:05.798: SSH2 0: ssh_receive: 68 bytes received *Jul  9 22:55:05.798: SSH2 0: input: total packet length of 48 bytes *Jul  9 22:55:05.798: SSH2 0: partial packet length(block size)16 bytes,needed 32 bytes,                maclen 20 *Jul  9 22:55:05.802: SSH2 0: MAC compared for #8 :ok *Jul  9 22:55:05.802: SSH2 0: input: padlength 19 bytes *Jul  9 22:55:05.802: SSH2 0: channel open request *Jul  9 22:55:05.802: SSH2 0: send:packet of  length 32 (length also includes padlen of 10) *Jul  9 22:55:05.802: SSH2 0: computed MAC for sequence no.#8 *Jul  9 22:55:05.818: SSH2 0: ssh_receive: 84 bytes received *Jul  9 22:55:05.818: SSH2 0: input: total packet length of 64 bytes *Jul  9 22:55:05.818: SSH2 0: partial packet length(block size)16 bytes,needed 48 bytes,                maclen 20 *Jul  9 22:55:05.818: SSH2 0: MAC compared for #9 :ok *Jul  9 22:55:05.818: SSH2 0: input: padlength 13 bytes *Jul  9 22:55:05.818: SSH2 0: send:packet of  length 16 (length also includes padlen of 6) *Jul  9 22:55:05.818: SSH2 0: computed MAC for sequence no.#9 *Jul  9 22:55:05.818: SSH2 0: pty-req request *Jul  9 22:55:05.818: SSH2 0: setting TTY - requested: height 47, width 132; set: height 47, width 132 *Jul  9 22:55:05.830: SSH2 0: ssh_receive: 52 bytes received *Jul  9 22:55:05.830: SSH2 0: input: total packet length of 32 bytes *Jul  9 22:55:05.834: SSH2 0: partial packet length(block size)16 bytes,needed 16 bytes,                maclen 20 *Jul  9 22:55:05.834: SSH2 0: MAC compared for #10 :ok *Jul  9 22:55:05.834: SSH2 0: input: padlength 12 bytes *Jul  9 22:55:05.834: SSH2 0: send:packet of  length 16 (length also includes padlen of 6) *Jul  9 22:55:05.834: SSH2 0: computed MAC for sequence no.#10 *Jul  9 22:55:05.834: SSH2 0: shell request *Jul  9 22:55:05.834: SSH2 0: shell message received *Jul  9 22:55:05.834: SSH2 0: starting shell for vty *Jul  9 22:55:05.934: SSH2 0: send:packet of  length 48 (length also includes padlen of 18) *Jul  9 22:55:05.934: SSH2 0: computed MAC for sequence no.#11 *Jul  9 22:55:05.934: SSH2 0: send:packet of  length 16 (length also includes padlen of 6) *Jul  9 22:55:05.934: SSH2 0: computed MAC for sequence no.#12 *Jul  9 22:55:05.934: SSH2 0: send:packet of  length 16 (length also includes padlen of 6) *Jul  9 22:55:05.934: SSH2 0: computed MAC for sequence no.#13 *Jul  9 22:55:05.934: SSH0: Session terminated normally Any advice... Thanks, Cesar ... View more

Re: Vpn site-to-site phase2 fail

Created by Cesar Adrian Garza Ruiz in VPN
‎07-09-2010 03:23 PM
‎07-09-2010 03:23 PM
In the remote side: c1861-advipservicesk9-mz.124-22.T4.bin In the hub side: c2801-advsecurityk9-mz.124-20.T5.bin I just tried with a DMVPN configuration but none, I just get this; *********HUB*********** Nothing !°! *******SPOKE******* GW_MONMORELOS#ping 10.1.1.1 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 10.1.1.1, timeout is 2 seconds: *Jul  9 21:54:12.958: ISAKMP:(0): SA request profile is (NULL) *Jul  9 21:54:12.958: ISAKMP: Created a peer struct for 201.116.153.194, peer port 500 *Jul  9 21:54:12.958: ISAKMP: New peer created peer = 0x8825CA7C peer_handle = 0x800000FB *Jul  9 21:54:12.958: ISAKMP: Locking peer struct 0x8825CA7C, refcount 1 for isakmp_initiator *Jul  9 21:54:12.958: ISAKMP: local port 500, remote port 500 *Jul  9 21:54:12.958: ISAKMP: set new node 0 to QM_IDLE      *Jul  9 21:54:12.958: ISAKMP:(0):insert sa successfully sa = 87B03520 *Jul  9 21:54:12.958: ISAKMP:(0):Can not start Aggressive mode, trying Main mode. *Jul  9 21:54:12.958: ISAKMP:(0):found peer pre-shared key matching 201.116.153.194 *Jul  9 21:54:12.958: ISAKMP:(0): constructed NAT-T vendor-rfc3947 ID *Jul  9 21:54:12.958: ISAKMP:(0): constructed NAT-T vendor-07 ID *Jul  9 21:54:12.958: ISAKMP:(0): constructed NAT-T vendor-03 ID *Jul  9 21:54:12.958: ISAKMP:(0): constructed NAT-T vendor-02 ID *Jul  9 21:54:12.958: ISAKMP:(0):Input = IKE_MESG_FROM_IPSEC, IKE_SA_REQ_MM *Jul  9 21:54:12.958: ISAKMP:(0):Old State = IKE_READY  New State = IKE_I_MM1 *Jul  9 21:54:12.958: ISAKMP:(0): beginning Main Mode exchange *Jul  9 21:54:12.958: ISAKMP:(0): sending packet to 201.116.153.194 my_port 500 peer_port 500 (I) MM_NO_STATE *Jul  9 21:54:12.958: ISAKMP:(0):Sending an IKE IPv4 Packet. *Jul  9 21:54:12.978: ISAKMP (0): received packet from 201.116.153.194 dport 500 sport 500 Global (I) MM_NO_STATE *Jul  9 21:54:12.978: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH *Jul  9 21:54:12.978: ISAKMP:(0):Old State = IKE_I_MM1  New State = IKE_I_MM2 *Jul  9 21:54:12.978: ISAKMP:(0): processing SA payload. message ID = 0 *Jul  9 21:54:12.978: ISAKMP:(0): processing vendor id payload *Jul  9 21:54:12.978: ISAKMP:(0): vendor ID seems Unity/DPD but major 69 mismatch *Jul  9 21:54:12.9.78: ISAKMP (0): vendor ID is NAT-T RFC 3947 *Jul  9 21:54:12.978: ISAKMP:(0):found peer pre-shared key matching 201.116.153.194 *Jul  9 21:54:12.978: ISAKMP:(0): local preshared key found *Jul  9 21:54:12.978: ISAKMP : Scanning profiles for xauth ... *Jul  9 21:54:12.978: ISAKMP:(0):Checking ISAKMP transform 1 against priority 1 policy *Jul  9 21:54:12.978: ISAKMP:      encryption 3DES-CBC *Jul  9 21:54:12.978: ISAKMP:      hash MD5 *Jul  9 21:54:12.978: ISAKMP:      default group 2 *Jul  9 21:54:12.978: ISAKMP:      auth pre-share *Jul  9 21:54:12.978: ISAKMP:      life type in seconds *Jul  9 21:54:12.978: ISAKMP:      life duration (VPI) of  0x0 0x1 0x51 0x80 *Jul  9 21:54:12.982: ISAKMP:(0):atts are acceptable. Next payload is 0 *Jul  9 21:54:12.982: ISAKMP:(0):Acceptable atts:actual life: 0 *Jul  9 21:54:12.982: ISAKMP:(0):Acceptable atts:life: 0 *Jul  9 21:54:12.982: ISAKMP:(0):Fill atts in sa vpi_length:4 *Jul  9 21:54:12.982: ISAKMP:(0):Fill atts in sa life_in_seconds:86400 *Jul  9 21:54:12.982: ISAKMP:(0):Returning Actual lifetime: 86400 *Jul  9 21:54:12.982: ISAKMP:(0)::Started lifetime timer: 86400. *Jul  9 21:54:12.982: ISAKMP:(0): processing vendor id payload *Jul  9 21:54:12.982: ISAKMP:(0): vendor ID seems Unity/DPD but major 69 mismatch *Jul  9 21:54:12.982: ISAKMP (0): vendor ID is NAT-T RFC 3947 *Jul  9 21:54:12.982: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE *Jul  9 21:54:12.982: ISAKMP:(0):Old State = IKE_I_MM2  New State = IKE_I_MM2 *Jul  9 21:54:12.982: ISAKMP:(0): sending packet to 201.116.153.194 my_port 500 peer_port 500 (I) MM_SA_SETUP *Jul  9 21:54:12.982: ISAKMP:(0):Sending an IKE IPv4 Packet. *Jul  9 21:54:12.982: ISAKMP:(0):Input = IKE_M.ESG_INTERNAL, IKE_PROCESS_COMPLETE *Jul  9 21:54:12.982: ISAKMP:(0):Old State = IKE_I_MM2  New State = IKE_I_MM3 *Jul  9 21:54:13.074: ISAKMP (0): received packet from 201.116.153.194 dport 500 sport 500 Global (I) MM_SA_SETUP *Jul  9 21:54:13.074: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH *Jul  9 21:54:13.074: ISAKMP:(0):Old State = IKE_I_MM3  New State = IKE_I_MM4 *Jul  9 21:54:13.074: ISAKMP:(0): processing KE payload. message ID = 0 *Jul  9 21:54:13.098: ISAKMP:(0): processing NONCE payload. message ID = 0 *Jul  9 21:54:13.098: ISAKMP:(0):found peer pre-shared key matching 201.116.153.194 *Jul  9 21:54:13.098: ISAKMP:(2239): processing vendor id payload *Jul  9 21:54:13.098: ISAKMP:(2239): vendor ID is Unity *Jul  9 21:54:13.098: ISAKMP:(2239): processing vendor id payload *Jul  9 21:54:13.098: ISAKMP:(2239): vendor ID is DPD *Jul  9 21:54:13.098: ISAKMP:(2239): processing vendor id payload *Jul  9 21:54:13.098: ISAKMP:(2239): speaking to another IOS box! *Jul  9 21:54:13.098: ISAKMP:received payload type 20 *Jul  9 21:54:13.098: ISAKMP (2239): His hash no match - this node outside NAT *Jul  9 21:54:13.098: ISAKMP:received payload type 20 *Jul  9 21:54:13.098: ISAKMP (2239): No NAT Found for self or peer *Jul  9 21:54:13.098: ISAKMP:(2239):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE *Jul  9 21:54:13.098: ISAKMP:(2239):Old State = IKE_I_MM4  New State = IKE_I_MM4 *Jul  9 21:54:13.098: ISAKMP:(2239):Send initial contact *Jul  9 21:54:13.098: ISAKMP:(2239):SA is doing pre-shared key authentication using id type ID_IPV4_ADDR *Jul  9 21:54:13.098: ISAKMP (2239): ID payload         next-payload : 8         type         : 1         address      : 189.152.38.131         protocol     : 17         por.t         : 500         length       : 12 *Jul  9 21:54:13.098: ISAKMP:(2239):Total payload length: 12 *Jul  9 21:54:13.098: ISAKMP:(2239): sending packet to 201.116.153.194 my_port 500 peer_port 500 (I) MM_KEY_EXCH *Jul  9 21:54:13.098: ISAKMP:(2239):Sending an IKE IPv4 Packet. *Jul  9 21:54:13.102: ISAKMP:(2239):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE *Jul  9 21:54:13.102: ISAKMP:(2239):Old State = IKE_I_MM4  New State = IKE_I_MM5 *Jul  9 21:54:13.118: ISAKMP (2239): received packet from 201.116.153.194 dport 500 sport 500 Global (I) MM_KEY_EXCH *Jul  9 21:54:13.118: ISAKMP:(2239): processing ID payload. message ID = 0 *Jul  9 21:54:13.118: ISAKMP (2239): ID payload         next-payload : 8         type         : 1         address      : 201.116.153.194         protocol     : 17         port         : 500         length       : 12 *Jul  9 21:54:13.122: ISAKMP:(0):: peer matches *none* of the profiles *Jul  9 21:54:13.122: ISAKMP:(2239): processing HASH payload. message ID = 0 *Jul  9 21:54:13.122: ISAKMP:(2239):SA authentication status:         authenticated *Jul  9 21:54:13.122: ISAKMP:(2239):SA has been authenticated with 201.116.153.194 *Jul  9 21:54:13.122: ISAKMP: Trying to insert a peer 189.152.38.131/201.116.153.194/500/,  and inserted successfully 8825CA7C. *Jul  9 21:54:13.122: ISAKMP:(2239):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH *Jul  9 21:54:13.122: ISAKMP:(2239):Old State = IKE_I_MM5  New State = IKE_I_MM6 *Jul  9 21:54:13.122: ISAKMP:(2239):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE *Jul  9 21:54:13.122: ISAKMP:(2239):Old State = IKE_I_MM6  New State = IKE_I_MM6 *Jul  9 21:54:13.122: ISAKMP (2239): received packet from 201.116.153.194 dport 500 sport 500 Global (I) MM_KEY_EXCH *Jul  9 21:54:13.122:. ISAKMP: set new node 781795278 to QM_IDLE      *Jul  9 21:54:13.122: ISAKMP:(2239):processing transaction payload from 201.116.153.194. message ID = 781795278 *Jul  9 21:54:13.122: ISAKMP: Config payload REQUEST *Jul  9 21:54:13.122: ISAKMP (2239): Unknown Input IKE_MESG_FROM_PEER, IKE_CFG_REQUEST:  state = IKE_I_MM6 *Jul  9 21:54:13.122: ISAKMP:(2239):Input = IKE_MESG_FROM_PEER, IKE_CFG_REQUEST *Jul  9 21:54:13.122: ISAKMP:(2239):Old State = IKE_I_MM6  New State = IKE_I_MM6 *Jul  9 21:54:13.122: ISAKMP:(2239):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE *Jul  9 21:54:13.122: ISAKMP:(2239):Old State = IKE_I_MM6  New State = IKE_P1_COMPLETE *Jul  9 21:54:13.122: ISAKMP:(2239):beginning Quick Mode exchange, M-ID of -1234842268 *Jul  9 21:54:13.126: ISAKMP:(2239):QM Initiator gets spi *Jul  9 21:54:13.126: ISAKMP:(2239): sending packet to 201.116.153.194 my_port 500 peer_port 500 (I) QM_IDLE      *Jul  9 21:54:13.126: ISAKMP:(2239):Sending an IKE IPv4 Packet. *Jul  9 21:54:13.126: ISAKMP:(2239):Node -1234842268, Input = IKE_MESG_INTERNAL, IKE_INIT_QM *Jul  9 21:54:13.126: ISAKMP:(2239):Old State = IKE_QM_READY  New State = IKE_QM_I_QM1 *Jul  9 21:54:13.126: ISAKMP:(2239):Input = IKE_MESG_INTERNAL, IKE_PHASE1_COMPLETE *Jul  9 21:54:13.126: ISAKMP:(2239):Old State = IKE_P1_COMPLETE  New State = IKE_P1_COMPLETE . Success rate is 0 percent (0/5) GW_MONMORELOS# *Jul  9 21:54:23.126: ISAKMP:(2239): retransmitting phase 2 QM_IDLE       -1234842268 ... *Jul  9 21:54:23.126: ISAKMP (2239): incrementing error counter on node, attempt 1 of 5: retransmit phase 2 *Jul  9 21:54:23.126: ISAKMP (2239): incrementing error counter on sa, attempt 1 of 5: retransmit phase 2 *Jul  9 21:54:23.126: ISAKMP:(2239): retransmitting phase 2 -1234842268 QM_IDLE      *Jul  9 21:54:23.126: ISAKMP:(2239): sending packet to 201.116.153.194 my_port 500 peer_port 500 (I) QM_IDLE      *Jul  9 21:54:23.126: ISAKMP:(2239):Sending an IKE IPv4 Packet. GW_MONMORELOS# GW_MONMORELOS# GW_MONMORELOS# GW_MONMORELOS# *Jul  9 21:54:28.118: ISAKMP (2239): received packet from 201.116.153.194 dport 500 sport 500 Global (I) QM_IDLE      *Jul  9 21:54:28.118: ISAKMP:(2239):processing transaction payload from 201.116.153.194. message ID = 781795278 *Jul  9 21:54:28.118: ISAKMP: Config payload REQUEST *Jul  9 21:54:28.118: ISAKMP:(2239): No provision for the request *Jul  9 21:54:28.118: ISAKMP: Invalid config REQUEST *Jul  9 21:54:28.118: ISAKMP (2239): FSM action returned error: 2 *Jul  9 21:54:28.118: ISAKMP:(2239):Input = IKE_MESG_FROM_PEER, IKE_CFG_REQUEST *Jul  9 21:54:28.118: ISAKMP:(2239):Old State = IKE_P1_COMPLETE  New State = IKE_P1_COMPLETE *Jul  9 21:54:28.118: ISAKMP:(2239):peer does not do paranoid keepalives. *Jul  9 21:54:28.118: ISAKMP:(2239):deleting SA reason "IKMP_ERR_NO_RETRANS" state (I) QM_IDLE       (peer 201.116.153.194) *Jul  9 21:54:28.118: ISAKMP: set new node -1734963281 to QM_IDLE      *Jul  9 21:54:28.118: ISAKMP:(2239): sending packet to 201.116.153.19 GW_MONMORELOS#4 my_port 500 peer_port 500 (I) QM_IDLE      *Jul  9 21:54:28.118: ISAKMP:(2239):Sending an IKE IPv4 Packet. *Jul  9 21:54:28.118: ISAKMP:(2239):purging node -1734963281 *Jul  9 21:54:28.118: ISAKMP:(2239):Input = IKE_MESG_INTERNAL, IKE_PHASE1_DEL *Jul  9 21:54:28.118: ISAKMP:(2239):Old State = IKE_P1_COMPLETE  New State = IKE_DEST_SA *Jul  9 21:54:28.122: ISAKMP:(2239):deleting SA reason "IKMP_ERR_NO_RETRANS" state (I) QM_IDLE       (peer 201.116.153.194) *Jul  9 21:54:28.122: ISAKMP:(0):Can't decrement IKE Call Admission Control stat outgoing_active since it's already 0. *Jul  9 21:54:28.122: ISAKMP: Unlocking peer struct 0x8825CA7C for isadb_mark_sa_deleted(), count 0 *Jul  9 21:54:28.122: ISAKMP: Deleting peer node by peer_reap for 201.116.153.194: 8825CA7C *Jul  9 21:54:28.122: ISAKMP:(2239):deleting node -1234842268 error FALSE reason "IKE deleted" *Jul  9 21:54:28.122: ISAKMP:(2239):deleting node 781795278 error FALSE reason "IKE deleted" *Jul  9 21:54:28.122: ISAKMP:(2239):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH *Jul  9 21:54:28.122: ISAKMP:(2239):Old State = IKE_DEST_SA  New State = IKE_DEST_SA Im lost ! Cesar ... View more

Re: Vpn site-to-site phase2 fail

Created by Cesar Adrian Garza Ruiz in VPN
‎07-09-2010 01:51 PM
‎07-09-2010 01:51 PM
Ok, this is the config that is working right now (but the vpn clients doesnt); In the other hand, actually I do not have any configuration for the other dynamic peer. I missing that?, (sorry, this is my first time that I have to configure a Vpn site to site, a vpn client, and a vpn site to site with dynamic IPs besides each other). *********************************HQ************************************ crypto isakmp policy 10 encr 3des hash md5 authentication pre-share group 2 crypto isakmp key ABC address 18.9.5.4 no-xauth crypto isakmp key abc address 0.0.0.0 0.0.0.0 no-xauth ! crypto isakmp client configuration group VPN-CLIENT key abc dns 192.168.210.10 192.168.210.20 pool mypool acl 110 ! crypto isakmp client configuration group VPNJF key abc dns 192.168.210.10 192.168.210.20 pool mypool acl 110 ! ! crypto ipsec transform-set myset esp-3des esp-sha-hmac ! crypto dynamic-map dynmap 10 set transform-set myset ! ! ! crypto map mymap client authentication list userauthen crypto map mymap isakmp authorization list groupauthor crypto map mymap client configuration address respond crypto map mymap 5 ipsec-isakmp set peer 18.2.5.14 set transform-set myset match address 120 crypto map mymap 10 ipsec-isakmp dynamic dynmap *For this config I do not put any match address because are learning from the other side. ----------------------------This do not work-------------------------------- ********** HQ ********* crypto keyring spokes   pre-shared-key address 0.0.0.0 0.0.0.0 key abc ! crypto isakmp policy 10 encr 3des hash md5 authentication pre-share group 2 crypto isakmp key ABC address 7.2.4.4 no-xauth ! crypto isakmp client configuration group VPN-CLIENT key abc dns 192.168.210.10 192.168.210.20 pool mypool acl 110 ! crypto isakmp client configuration group VPNJF key xyz dns 192.168.210.10 192.168.210.20 pool mypool acl 110 crypto isakmp profile L2L    keyring spokes    match identity address 0.0.0.0 ! ! crypto ipsec transform-set myset esp-3des esp-sha-hmac ! crypto dynamic-map dynmap 5 set transform-set myset set isakmp-profile L2L match address mtmorelos crypto dynamic-map dynmap 10 set transform-set myset ! ip access-list extended mtmorelos permit ip 192.168.0.0 0.0.255.255 192.168.225.0 0.0.0.255 permit ip 192.168.0.0 0.0.255.255 192.168.226.0 0.0.0.255 ******************************Remote Side******************************* *The same config in both cases. ! crypto isakmp policy 1 encr 3des hash md5 authentication pre-share group 2 crypto isakmp key Citro2008 address 1.6.3.4 no-xauth ! ! crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac !         crypto map lan2lan 1 ipsec-isakmp description ## Hacia Citro Corp ## set peer 1.6.3.4 set transform-set ESP-3DES-SHA match address lan2lan ! ip access-list extended lan2lan permit ip 192.168.225.0 0.0.0.255 192.168.0.0 0.0.255.255 permit ip 192.168.226.0 0.0.0.255 192.168.0.0 0.0.255.255 ! Cesar El mensaje fue editado por: Cesar Garza ... View more

Re: Vpn site-to-site phase2 fail

Created by Cesar Adrian Garza Ruiz in VPN
‎07-09-2010 11:57 AM
‎07-09-2010 11:57 AM
Hi Marcin,      Before thanks for answer, unfortunately after the changes that you suggest I do not see any change, but the good news is when I remove all the configuration about the profile, the keyring and the crypto 5, and only put the line "crypto isakmp key abc address 0.0.0.0 0.0.0.0 no-xauth" is working, yesterday it was not work in that way I dont know if all the other config was making some trouble, but the bad thing is that the VPN  Clients stills outs, now my cuestion is, is there any way to make that both configs work together?. Config in HQ ! crypto isakmp policy 10 encr 3des hash md5 authentication pre-share group 2 crypto isakmp key notnow address 187.92.54.114 no-xauth crypto isakmp key crazyvpn address 0.0.0.0 0.0.0.0 no-xauth ! crypto isakmp client configuration group VPN-CLIENT key Avayawork dns 192.168.210.10 192.168.210.20 pool mypool acl 110 ! crypto isakmp client configuration group VPNJF key sunwork dns 192.168.210.10 192.168.210.20 pool mypool acl 110 ! ! crypto ipsec transform-set myset esp-3des esp-sha-hmac ! crypto dynamic-map dynmap 10 set transform-set myset ! ! ! crypto map mymap client authentication list userauthen crypto map mymap isakmp authorization list groupauthor crypto map mymap client configuration address respond crypto map mymap 5 ipsec-isakmp set peer 1x7.y2.z4.w14 set transform-set myset match address 120 crypto map mymap 10 ipsec-isakmp dynamic dynmap ! INTERNET_TMX#SH CRYpto SESsion Crypto session current status Interface: FastEthernet0/0 Session status: UP-ACTIVE     Peer: 1X7.Y2.Z4.W14 port 500   IKE SA: local X01.Y16.Z53.W94/500 remote X87.Y2.Z4.W14/500 Active   IPSEC FLOW: permit ip 192.168.208.0/255.255.240.0 192.168.240.0/255.255.252.0         Active SAs: 0, origin: crypto map   IPSEC FLOW: permit ip 192.168.224.0/255.255.240.0 192.168.240.0/255.255.252.0         Active SAs: 2, origin: crypto map   IPSEC FLOW: permit ip 192.168.32.0/255.255.247.0 192.168.240.0/255.255.252.0         Active SAs: 0, origin: crypto map Interface: FastEthernet0/0 Session status: UP-ACTIVE <------------------- is this one !    Peer: X89.Y52.Z8.W31 port 500   IKE SA: local X01.Y16.Z53.W94/500 remote S89.Y52.Z8.W31/500 Active   IPSEC FLOW: permit ip 192.168.0.0/255.255.0.0 192.168.225.0/255.255.255.0         Active SAs: 2, origin: dynamic crypto map   IPSEC FLOW: permit ip 192.168.0.0/255.255.0.0 192.168.226.0/255.255.255.0         Active SAs: 2, origin: dynamic crypto map any idea??? Cesar ... View more

Re: Vpn site-to-site phase2 fail

Created by Cesar Adrian Garza Ruiz in VPN
‎07-09-2010 10:36 AM
‎07-09-2010 10:36 AM
Yes, but I did the configuration of the line "crypto isakmp key abc address 0.0.0.0 0.0.0.0 no-xauth" but this cause conflict with the connection of the user of the VPN Client, until I quit the line the VPN client is connected as always, I do not find any other form to keep the no-xauth, this is a peer with no fixed IP. I get this error in the debug when I tried to connect the VPN Client: *Jul  9 17:17:54.674: ISAKMP : Scanning profiles for xauth ... *Jul  9 17:17:54.674: ISAKMP:(0):Checking ISAKMP transform 1 against priority 10 policy *Jul  9 17:17:54.674: ISAKMP:      encryption AES-CBC *Jul  9 17:17:54.674: ISAKMP:      hash SHA *Jul  9 17:17:54.674: ISAKMP:      default group 2 *Jul  9 17:17:54.674: ISAKMP:      auth XAUTHInitPreShared *Jul  9 17:17:54.674: ISAKMP:      life type in seconds *Jul  9 17:17:54.674: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B *Jul  9 17:17:54.674: ISAKMP:      keylength of 256 *Jul  9 17:17:54.674: ISAKMP:(0):Encryption algorithm offered does not match policy! *Jul  9 17:17:54.674: ISAKMP:(0):atts are not acceptable. Next payload is 3 . . . . *Jul  9 17:17:54.674: ISAKMP : Scanning profiles for xauth ... *Jul  9 17:17:54.674: ISAKMP:(0):Checking ISAKMP transform 1 against priority 10 policy *Jul  9 17:17:54.674: ISAKMP:      encryption AES-CBC *Jul  9 17:17:54.674: ISAKMP:      hash SHA *Jul  9 17:17:54.674: ISAKMP:      default group 2 *Jul  9 17:17:54.674: ISAKMP:      auth XAUTHInitPreShared *Jul  9 17:17:54.674: ISAKMP:      life type in seconds *Jul  9 17:17:54.674: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B *Jul  9 17:17:54.674: ISAKMP:      keylength of 256 *Jul  9 17:17:54.674: ISAKMP:(0):Encryption algorithm offered does not match policy! *Jul  9 17:17:54.674: ISAKMP:(0):atts are not acceptable. Next payload is 3 *Jul  9 17:17:54.686: ISAKMP:(0):deleting SA reason "Phase1 SA policy proposal not accepted" state (R) AG_NO_STATE (peer x01.y55.z30.w45) ... View more

Vpn site-to-site phase2 fail

Created by Cesar Adrian Garza Ruiz in VPN
‎07-09-2010 08:34 AM
‎07-09-2010 08:34 AM
Hi everyone,  I Have two sites in HQ I have a C2801 as Hub, and in the remote side I have a C1861 as spoke that is getting the Ip through an ADSL , after I configured both rtrs, all Steps in Phase1 are complete, at the next Phase, I get the error IKMP_ERR_NO_RETRANS, I read a lot of entries here, but none is like the one I have. Please can check if I missed some in the configuration. Another thing is that in the same C2801 I got a VPN Client and another vpn site to site, with fixed IP address and work perfect. Network in Remote Side: 192.168.225.0/24 and 192.168.226.0/24 Networks in HQ: 192.168.0.0 I attached the configs and debugs. ... View more
Labels:
Public Statistics
Date Registered ‎09-03-2008 03:17 PM
Date Last Visited ‎07-18-2018 12:03 AM
Total Messages Posted 22
Total Helpful Votes Received 19
Badges
Bio
Empece a trabajar en telecomunicaciones en Avantel una empresa de Telecomunicaciones a nivel nacional, donde principalmente atendia los requerimientos para las centrales telefonicas locales y tandems de larga distancia, con la convergencia de datos y voz, empece a involucrarme al area de datos donde se entregaban servicios de MPLS e Internet, pero con mi background de voz rapidamente empece a configurar las soluciones de Voz sobre IP que se ofrecian, implemente SoftSwitches, Gateways, Gatekeepers, trabaje con protocolos de Ruteo principalmente BGP, y haciendo mucho troubleshooting en protocolos de voz, H323 y SIP. Luego emigre a Micronet de Mexico que es un partner Gold de cisco, donde potencie mi conocimientos de Voz sobre IP para entrar de lleno a las comunicaciones unificadas de Cisco principalmente implementando soluciones de Telefonia en CUCM, Unity, IPCC. Posteriormente cambie a Connext donde he trabajado como Ingeniero Senior para implementaciones de soluciones de comunicaciones Unificadas de Cisco.
Helpful Votes Given To